# Fetch an app registration

GET

/v1/connection-apps/{appId}

```sh
curl --request GET \
  --url https://example.com/v1/connection-apps/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \
  --header 'Authorization: Bearer <token>'
```

## Authorizations

- **[bearerAuth](https://docs.kindgi.com/reference/api.md#bearerauth)**

## Parameters

### Path Parameters

**appId**

required

string format: uuid

The app registration id (a UUID).

## Responses

### 200

The registration.

application/json

A workspace’s registration of its own client at an app. Secrets are references, never values.

object

**appId**

required

string format: uuid

**app**

required

The app’s entry id.

string

**label**

string

**oauth2**

object

**clientId**

required

string

**clientSecret**

required

A secret by name in the deployment’s secrets store, resolved at tenant scope. The registration keeps only this reference, never the value.

object

**envName**

required

string

/^\[a-z]\[a-z0-9-]{0,62}$/

**name**

required

string

\>= 1 characters <= 256 characters

**tenant**

The directory the app signs people in at, for an app whose sign-in names one: Microsoft’s tenant id or domain for a single-tenant app, `organizations`, `common` or `consumers` for a multi-tenant one. Required when the app’s entry has no default, refused for an app without one (`connection-app-invalid`, `details.field` `oauth2.tenant`).

string

\>= 1 characters <= 253 characters

**githubApp**

object

**appNumber**

required

integer

\>= 1

**slug**

required

The app’s slug.

string

**clientId**

required

string

**clientSecret**

required

A secret by name in the deployment’s secrets store, resolved at tenant scope. The registration keeps only this reference, never the value.

object

**envName**

required

string

/^\[a-z]\[a-z0-9-]{0,62}$/

**name**

required

string

\>= 1 characters <= 256 characters

**privateKey**

required

A secret by name in the deployment’s secrets store, resolved at tenant scope. The registration keeps only this reference, never the value.

object

**envName**

required

string

/^\[a-z]\[a-z0-9-]{0,62}$/

**name**

required

string

\>= 1 characters <= 256 characters

**webhookSecret**

required

A secret by name in the deployment’s secrets store, resolved at tenant scope. The registration keeps only this reference, never the value.

object

**envName**

required

string

/^\[a-z]\[a-z0-9-]{0,62}$/

**name**

required

string

\>= 1 characters <= 256 characters

**projects**

The projects whose runs may use its connections. Absent: every project.

Array\<string>

**redirectUrl**

required

Give this to the app as its redirect URL: a GitHub App’s Callback URL, with “Request user authorization (OAuth) during installation” ticked.

string format: uri

**noticesUrl**

required

Give this to the app as the place it reports removals.

string format: uri

**createdAt**

required

string format: date-time

**updatedAt**

required

string format: date-time

**removedAt**

string format: date-time

##### Examplegenerated

```json
{
  "appId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "app": "example",
  "label": "example",
  "oauth2": {
    "clientId": "example",
    "clientSecret": {
      "envName": "example",
      "name": "example"
    },
    "tenant": "example"
  },
  "githubApp": {
    "appNumber": 1,
    "slug": "example",
    "clientId": "example",
    "clientSecret": {
      "envName": "example",
      "name": "example"
    },
    "privateKey": {
      "envName": "example",
      "name": "example"
    },
    "webhookSecret": {
      "envName": "example",
      "name": "example"
    }
  },
  "projects": [
    "example"
  ],
  "redirectUrl": "https://example.com",
  "noticesUrl": "https://example.com",
  "createdAt": "2026-04-15T12:00:00Z",
  "updatedAt": "2026-04-15T12:00:00Z",
  "removedAt": "2026-04-15T12:00:00Z"
}
```

### 400

`appId` is not a UUID (`bad-input`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 401

Missing / malformed / expired / revoked bearer token.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 403

Not a tenant admin (`permission-denied`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 404

No registration with that id (`connection-app-not-found`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 503

The database was too busy to answer in time (`database-busy`); `Retry-After` (whole seconds) says when to try again.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

## See also

- [`PATCH /v1/connection-apps/{appId}`: Update an app registration](https://docs.kindgi.com/reference/api/operations/connectionappsupdate.md)
- [`DELETE /v1/connection-apps/{appId}`: Remove an app registration](https://docs.kindgi.com/reference/api/operations/connectionappsremove.md)
- [Error code `bad-input`](https://docs.kindgi.com/reference/errors.md#bad-input)
- [Error code `connection-app-not-found`](https://docs.kindgi.com/reference/errors.md#connection-app-not-found)
- [Error code `database-busy`](https://docs.kindgi.com/reference/errors.md#database-busy)
- [Error code `permission-denied`](https://docs.kindgi.com/reference/errors.md#permission-denied)
- [Every error code](https://docs.kindgi.com/reference/errors.md)